Stateful Inspection; Table 36 Icmp Commands That Trigger Alerts; Table 37 Legal Netbios Commands; Table 38 Legal Smtp Commands - ZyXEL Communications G.SHDSL.bis 4-port Security Gateway P-793H User Manual

Chapter 8 Firewalls
8.4.2.1 ICMP Vulnerability
ICMP is an error-reporting protocol that works in concert with IP. The following ICMP types
trigger an alert:

Table 36 ICMP Commands That Trigger Alerts

5
13
14
17
18
8.4.2.2 Illegal Commands (NetBIOS and SMTP)
The only legal NetBIOS commands are the following - all others are illegal.

Table 37 Legal NetBIOS Commands

MESSAGE:
REQUEST:
POSITIVE:
VE:
RETARGET:
KEEPALIVE:
All SMTP commands are illegal except for those displayed in the following tables.

Table 38 Legal SMTP Commands

AUTH
QUIT
8.4.2.3 Traceroute
Traceroute is a utility used to determine the path a packet takes between two endpoints.
Sometimes when a packet filter firewall is configured incorrectly an attacker can traceroute
the firewall gaining knowledge of the network topology inside the firewall.
Often, many DoS attacks also employ a technique known as "IP Spoofing" as part of their
attack. IP Spoofing may be used to break into systems, to hide the hacker's identity, or to
magnify the effect of the DoS attack. IP Spoofing is a technique used to gain unauthorized
access to computers by tricking a router or firewall into thinking that the communications are
coming from within the trusted network. To engage in IP spoofing, a hacker must modify the
packet headers so that it appears that the packets originate from a trusted host and should be
allowed through the router or firewall. The ZyXEL Device blocks all IP Spoofing attempts.

8.5 Stateful Inspection

With stateful inspection, fields of the packets are compared to packets that are already known
to be trusted. For example, if you access some outside service, the proxy server remembers
things about your original request, like the port number and source and destination addresses.
This "remembering" is called saving the state. When the outside system responds to your
request, the firewall compares the received packets with the saved state to determine if they
122
REDIRECT
TIMESTAMP_REQUEST
TIMESTAMP_REPLY
ADDRESS_MASK_REQUEST
ADDRESS_MASK_REPLY
DATA EHLO ETRN
RCPT RSET SAML
EXPN HELO HELP
SEND SOML TURN
MAIL NOOP
VRFY
P-793H User's Guide